Restricted Groups Propagating to Most but not All Users...

Discussion in 'Active Directory' started by Wes H, Jun 19, 2009.

  1. Wes H

    Wes H Guest

    This is weird, so I created an AD security called LocalAdmin and put a couple
    people I wanted to give local admin rights to into that group. I then went
    into the Default Domain Policy and under computer/security/restricted groups
    I created a new one and used the "member of " way so it wouldn't remove
    anything. I made my new AD group called LocalAdmins and member of
    "administrators" group. Now, this worked for about 95% of the organization
    (it took like 2 days), but there were a handful of computers that I had to
    manually do a GPUPdate /force on to get it to work. Why would that be? I
    looked and these computers are in the same OU as some other ones that worked.
    Any ideas?

    -Wes
     
    Wes H, Jun 19, 2009
    #1
    1. Advertisements

  2. Wes H

    Marcin Guest

    Wes - this is not expected - since security settings should be applied to
    domain member computers every 16 hours... Do you see event 1704 in the
    Application event log on those clients? Is there any chance that they were
    off the network during the refresh interval? If not, I'd suggest following
    standard GPO troubleshooting methods - as described in
    http://technet.microsoft.com/en-us/library/cc787386(WS.10).aspx

    hth
    Marcin
     
    Marcin, Jun 19, 2009
    #2
    1. Advertisements

  3. Wes H

    Wes H Guest

    Thanks for the reply. Ok, I checked the event viewer on the PC in questions,
    and she had 1704's in there for days, so she was getting the updates. It was
    just that I had to manually do a gpupdate /force for them to apply??? That
    is bizzare. Do you think this is because I put it into the default domain
    policy? Why would almost all other users get them?

    -Wes
     
    Wes H, Jun 19, 2009
    #3
  4. Wes H

    Marcin Guest

    Wes,
    modifying the Default Domain Policy in general is not a good idea - so I'd
    avoid it in the future, but I don't see a reason why this would cause the
    issue you are describing. You can use the link I provided to troubleshoot it
    further...

    hth
    Marcin
     
    Marcin, Jun 19, 2009
    #4
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.